build: force bash for recipes (Linux dash printf \x1f trap)

What:
Makefile: add `SHELL := /bin/bash`.

Why:
The first Tier C boot-smoke run on the Linux runner failed building the first
user crate:
  rust-lld: error: cannot find linker script link.ld\x1f-Clink-arg=-z\x1f...
GNU make defaults SHELL to /bin/sh; on Ubuntu that is dash, whose printf does
not support `\xHH` hex escapes. Every user-crate rule joins rustflags into
CARGO_ENCODED_RUSTFLAGS with `printf '%s\x1f%s' ...`; under dash the 0x1F
separators come through as literal "\x1f" text, so cargo passes the whole
rustflags string as one unsplit linker arg and the linker-script path mangles.
macOS /bin/sh is bash (printf understands \x), so this was invisible locally.
Forcing bash -- present on both macOS and Ubuntu -- makes the Linux build match.

Out of scope:
No recipe text changes; one SHELL assignment fixes every printf-based rule at
once. Any further Linux-portability issues down the boot-smoke path surface on
the next run.

Verification:
  - /bin/bash -c "printf '%s\x1f%s' A B" | od -> 41 1f 42 (the real 0x1F byte).
  - make fs-service under SHELL:=/bin/bash -> builds clean on macOS (no
    regression).
  - The Linux build is confirmed by re-running the boot-smoke workflow.

Staged files:
  Makefile

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: riccajason

Makefile

@@ -15,6 +15,16 @@
 #   make run SIGN_MODE=seed         # Seed-based signing (CI/testing)
 #   CAMBIO_SIGN_PIN=123456 make run # YubiKey with PIN via env var
 
+# Force bash for all recipes. GNU make defaults SHELL to /bin/sh, which on Linux
+# is dash — and dash's printf does NOT support `\xHH` hex escapes. Every
+# user-crate rule builds CARGO_ENCODED_RUSTFLAGS via `printf '%s\x1f%s' ...` to
+# join rustflags with the 0x1F separator byte; under dash that emits the literal
+# text "\x1f", cargo then passes the whole rustflags blob as one unsplit linker
+# arg, and the linker-script path mangles ("cannot find linker script
+# link.ld\x1f..."). macOS /bin/sh is bash, so this was invisible until the Linux
+# boot-smoke CI runner hit it.
+SHELL := /bin/bash
+
 KERNEL := target/x86_64-unknown-none/release/cambios_microkernel
 ISO := cambios.iso
 LIMINE_DIR := $(HOME)/.cache/cambios/limine